ci: expose nightly tree dependencies and publisher ownership
The nightly status cannot identify which artifact-tree publisher blocks a build. The request was: “The nightly-stale line doesn't name what blocks it” and “A tree owner queued more than 3 min should show up as the nightly's blocker.”
Publish small observational artifacts from the existing decisions, before the heavy jobs queue:
- A pending nightly dependency names its canonical v2 tree key, selected build SHA and run attempt. It deliberately does not substitute the workflow-control SHA for the build source.
- A publisher records ownership only when the existing preflight or takeover decision says it owns an unpublished tree. The fixed artifact name supports exact-key lookup; its JSON contains the run ID and attempt, which readers must match against the current attempt.
- Uploads are advisory, capped at one minute and retained for three days. Missing, expired, ambiguous or old-attempt evidence means unknown. No claims, workflow permissions, runner selection or release gates change.
Contract: nightly-tree-dependency-KEY-BUILDSHA-attempt-N contains tree-dependency.json; cmux-tui-tree-owner-KEY contains tree-owner.json. JSON fields are schema_version:1, kind, key, run_id, run_attempt, plus build_sha only for a dependency. Owner markers use overwrite for a rerun; consumers must still reject an old attempt. Runs created before this producer lands cannot be retroactively identified from these markers.
Validation: fleet run 41278321960 passed all 33 Python tests, the nightly-resolver check and the 231-workflow permission scan. Its terminal receipt binds tested_sha=3d4b174746b5ed17b2f91f5aceead2f11df999f4 to snapshot 4913d3a2dd08b2789b6c9a2c4d0bb70e34d72545, with exit 0 in 24.709 s on 16 CPUs. Existing warm test snapshot path is reused; no app compile or runner routing change is needed.
Independent Opus 5.5 medium review: SHIP at the same full head. Nonblocking follow-ups: #30227.
Prior art: preserves #28197's tree-at-install behavior, #26800's distinction between publication and daemon testing, #26781's bounded owner election and #28764's compatibility-tree resolution. The new evidence uses the canonical key, not a compatible published alias. The overlap helper found no open PR for this change.
Agent session: agent session